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DETAILED ACTION 

This final rejection is in response to Applicant's amendment and arguments which were 
filed on 7/13/2009. Claims 3, 6, 8, 9, 1 1, 14, 17, 19, 20, and 22 are amended. Claim 18 is 
cancelled. Claims 1, 2, 4, 5, 10, 12, 13, 15, 16, and 21 were previously cancelled. Accordingly, 
claims 3, 6-9, 11, 14, 17, 19, 20, and 22-30 are presented for further examination. 

Response to Arguments 
I. Applicant's arguments with respect to the § 103 rejection are not 

PERSUASIVE. 

A. Claims 3 and 14 

With respect to claim 3, Applicant argues that Abraham fails to disclose (1) a 
certification server including a memory that stores a monitoring parameter or a threshold 
parameter and (2) a second device (within the certification server) which transmits a request to 
the packet monitor device to start/finish monitoring packets when said end-user logs-in or logs- 
out the terminal. Applicant's arguments have been carefully considered but are not persuasive. 

1 . Abraham discloses elements of the domain controller server may be 
implemented in any suitable server in the network. 

As an initial matter, the examiner apologizes for not clearly mapping elements in the 

Abraham reference to the elements in Applicant's claims or explaining the rejections more 

clearly. Applicant notes that the rejection cited both Abraham's domain controller server and the 

network server. Applicant argues that Abraham's domain controller server cannot read on the 

claimed certification server because it does not contain a memory for storing the monitoring 

parameters. 
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Abraham discloses that components of the domain controller server which certify the user 
(host agent) "may be located on any suitable computer connected to the LAN 44" [column 9 
«lines 39-4 1»]. Based on this teaching, one of ordinary skill in the art would have been able to 
implement the certification functionality (implemented by the host agent in the domain 
controller) within the network server (being a suitable computer connected to the LAN). 

Modified in this manner, the network server reads on the claimed certification server as 

the network server would contain elements that certify users and comprising memory for storing 

monitoring parameters. 

2. Abraham's filter executive and filter engine read on the second device and 
filter executive, respectively. 

Applicant argues that there is no teaching that the filter executive (within the network 
server) receiving a request from the domain controller server upon which the filter executive 
monitors packets. The relevant limitation in the claim recites a second device (within the 
certification server) which transmits a request to a packet monitor device to start/finish 
monitoring. Applicant's argument is not persuasive because Abraham's domain controller server 
is not being compared to Applicant's second device and the filter executive is not being 
compared to the Applicant's packet monitor. 

Abraham discloses a filter engine that is responsible for monitoring packets that pass 
through the network server. Thus, Abraham's filter engine reads on Applicant's claimed packet 
monitor. Abraham further discloses "as a user logs into and out of the LAN 44, the filter engine 
78 begins or ceases to filter IP packets passing through to network server 50 for the user 
accordingly" [column 8 «lines 23-25»]. Moreover, "the filter engine 78 will be notified 
immediately if a user of the LAN 44 logs into or out of the LAN and will begin or cease filtering 
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IP packets accordingly" [column 50 «lines 24-27»]. The notification comes from the filter 
executive (which is part of Abraham's certification server). 

These teachings are consistent with Applicant's claim which require a second device 
(within the certification server) (Abraham's filter executive) which transmits a request to the 
packet monitor device to start/finish monitoring packets (filter engine receives notification from 
the filter executive to begin or cease filtering IP packets) when said end-user logs-in or logs-out 
the terminal ("notified immediately if a user of the LAN logs into or out of the LAN"). 

B. Claims 8 and 19 

Applicant's arguments are not relevant to claims 8 and 19 because claim 8 does not recite 
(1) a certification server including a memory that stores a monitoring parameter or a threshold 
parameter or (2) a second device (within the certification server) which transmits a request to the 
packet monitor device to start/finish monitoring packets when said end-user logs-in or logs-out 
the terminal. Thus, even if Applicant's arguments were persuasive with respect to claims 3 and 
14, they would not be persuasive for claims 8 and 19 because they do not contain the relevant 
limitations argued by Applicant. 

C. Claim 30 

Applicant argues that the AAPA does not disclose claim 30's limitation of a service 
identifier comprising data for identifying a service provided for a fee. Applicant's argument is 
not persuasive because the rejection did not rely on the AAPA to teach a service identifier. As 
indicated in the rejection of claim 3, Abraham taught monitoring a service identifier of said 
packets [column 21 «lines 39-50» : protocol ID identifies the type of service - for example, 
email, web, or FTP]. 
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What Abraham failed to teach was that any of these services (which were identified by 
Abraham's service ID) were provided for a fee as recited in claim 30. The rejection relied on the 
AAPA to teach the well known function of providing fee-based services. Thus, the proposed 
combination modified Abraham's service identifier and services to include fee-based services as 
taught in the AAPA. 
II. Conclusion 

For the foregoing reasons, Applicant's arguments are not persuasive. Applicant's 
amendment, which do not affect the claim's scope, are addressed in the following claim 
mapping. The rejection as set forth in the previous action is therefore maintained. 



Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



III. Claims 3, 6-9, 11, 14, 17, 19, 20 and 22-25 are rejected under 35 U.S.C §103(a) as 

BEING UNPATENTABLE OVER ABRAHAM ET AL, U.S PATENT NO. 5.983.270 

["Abraham"], in view of Nickles, U.S Patent No. 6.134.591, in further view of 
Bruins et al, U.S. Patent No. 6.308.148 ["Bruins"]. 

Claims 3 and 14 

As to claims 3 and 14, Abraham discloses a system for monitoring packets transmitted on 
a channel connecting an application server and an end-user of said application server to each 



other, said system comprising: 
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a certification server which certifies an end-user [column 5 «line 63» to column 6 «line 
4»]; and 

a packet monitor device which, on receipt of a request from said certification server, 
monitors packets transmitted on said channel [column 1 «lines 13-17» | column 7 «lines 51-67»], 
wherein said certification server comprises: 

a first memory which stores a user management table including ID numbers of 
end-users, a monitoring parameter designating a packet to be monitored, a threshold 
parameter designating a method of monitoring said packet [Figures 9D, 17, 25 A, 25B : 
notify rule, log rule | column 15 «lines 35-40»]; and 

a second device which transmits a request to said packet monitor device to start or 
finish monitoring said packet at a timing when said end-user logs-in or logs-out the 
terminal [column 9 «lines 1-1 0»]; 
wherein said packet monitor device comprises: 

a fourth memory which stores a first time at which a packet transmitted from one of 
said application server and said user arrives, when said packet monitor device receives a request 
from said second device to monitor said packet [Figure 20 | column 47 «lines 14-24»]; 

an analyzer which monitors a second time at which packets meeting said monitoring 
parameter arrive, and determines whether any rule has been satisfied during an interval between 
said first time and said second time [column 7 «lines 51-67» | column 9 «lines 51-65» | column 
47 «lines 14-24» | column 41 «line 53» to column 42 «line 42»]; and 

an annunciator which makes annunciation to said user when a certain rule is satisfied 
during said interval [Figure 26 | column 1 1 «lines 53-64» | column 13 «lines 62-67]; and 
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wherein said packet monitor device is configured to monitor at least one of a data 
sequence of said packets, a service identifier of said packets [Figure 8 J | column 21 «lines 39-50» 
: protocol ID identifies the type of service - for example, email, web, or FTP], and a checksum 
of said packet; and 

wherein said threshold parameter is a predetermined number [Fig. 25b «item 1 77»] . 

Abraham does not expressly disclose (1) storing a password in the table or (2) wherein 
said rule is that whether a total number of continuously receiving packets meeting said 
monitoring parameter in said interval is over said predetermined number. However both features 
were well known in the art at the time of Applicant's invention as evidenced by Nickles and 
Bruins. 

As to the first limitation, Abraham does disclose storing user's information, including the 
user's ID and access level [column 16 «lines 6-9»]. Additionally, as is well known in the art, 
Abraham also discloses the feature whereby a user logs on to his terminal using a password 
[column 5 «lines 63-67» | see also response to arguments above]. In a related field of invention, 
Nickles discloses a management database that stores usernames with their respective passwords 
for the same purpose as Abraham [Figure 7 «item 708a» | column 6 «lines 7-17»]. Therefore it 
would have been obvious to one of ordinary skill in the art to have reasonably inferred that 
Abraham's management table would contain passwords. Such a feature is implied by Abraham 
because he teaches that a user is monitored only after logging into the LAN. One of ordinary 
skill in the art would understand this to include submitting a user ID and a password as is well 
known in the art. Thus, passwords are stored with user IDs, as further evinced by Nickles. 
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As to the second limitation, Bruins is directed to a system for collecting and using data 
related to message flows such as packet information [abstract]. Bruins discloses a rule for 
determining whether a total number of packets meeting a monitoring parameter (from a specific 
device and user) is over a predetermined number [column 1 «lines 26-3 6» | column 5 «lines 13- 
22»: billing users based on total number of packets]. This interpretation of Applicant's claim is 
consistent with Applicant's specification which describes a monitoring parameter as a device 
address and the rule relates to monitoring the total number of packets from that specific device. 

It would have been obvious to one of ordinary skill in the art to have modified Abraham's 
invention to include Bruins packet collection functionality. Bruins discloses the ability to collect 
specific packet information are useful to expand the number of ways of billing users (such as for 
total number of packets). Additionally, modifying Abraham's system to include such a feature is 
merely an example of using a known technique (Bruins' monitoring of the total number of 
packets for a specific device) to improve similar devices (Abraham's packet monitoring and 
billing system) in the same way (able to bill users based on total number of packets). 

Claims 6 and 17 

As to claims 6 and 17, Abraham discloses the packet monitor device further comprises: 
a second memory which stores said monitoring parameter transmitted from said 

second device [column 7 «lines 22-50»]; 

a third memory which stores said threshold parameter transmitted from said second 

device [column 2 «lines 47-5 3 » | column 7 «lines 22-5 0»]; and 
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a third device which said third and fourth memories when said second device transmits a 
request to said packet monitor device to start or finish monitoring said packet [column 6 «line 
60» to column 7 «line 3» | column 7 «lines 22-50» | column 47 «lines 5-24»]. 

Claims 7 and 18 

As to claims 7 and 18, Abraham discloses the analyzer analyzing whether there is any 
rule in said interval and whether said interval exceeds said threshold parameter [column 1 1 
«lines 53-64»], and said annunciator makes annunciation to said end-user when said analyzer 
judges that there is a certain rule in said interval and that said interval exceeds said threshold 
parameter [column 13 «lines 53-60»]. 

Claims 8 and 19 

As to claims 8 and 19, Abraham discloses a method of monitoring packets transmitted on 
a channel connecting an application server and an end-user of said application server to each 
other, comprising the steps of: 

acquiring from a certification server a monitoring parameter indicative of a packet to be 
monitored, when said end-user logs-in his|her terminal [column 5 «line 63» to column 6 «line 
4»]; 

monitoring a time at which packets coincident with said monitoring parameter arrive, and 
determining whether there is any rule in an interval between a time when the monitoring 
parameter is acquired said arrival time [column 7 «lines 51-67» | column 1 1 «lines 53-64» | 
column 41 «line 53» to column 42 «line 42»]; 

making annunciation to said end-user when there is a certain rule in said interval [column 
13 «lines 61-67»]; and 
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monitoring at least one of a data sequence of said packets, a service identifier of said 
packets [Figure 8 J | column 21 «lines 39-50» : protocol ID identifies the type of service - for 
example, email, web, or FTP], and a checksum of said packet; 

wherein said monitoring parameter is included in a user management table which further 
includes an ID number of said user and a threshold parameter designating a method of 
monitoring said packet [Figures 9D, 17, 25 A, 25B : notify rule, log rule | column 15 «lines 35- 
40»], and the acquiring the monitoring parameter (a) comprises: 

retrieving said user management table, based on said ID number input by said end- 
user [column 8 «lines 13-25» | column 16 «lines 12-19» : user must log in to the LAN before 
monitoring begins - process of logging in submits his user ID]; 

acquiring said monitoring parameter, if said monitoring parameter is stored in said 
user management table [Figure 17 : user rules]; and 

acquiring said threshold parameter, if said threshold parameter is stored in said user 
management table [Figures 17, 25B : user policies such as quota limit | column 34 «lines 11- 
58»], and 

and 

wherein said threshold parameter is a predetermined number [Fig. 25b «item 1 77»] . 

Abraham does not expressly disclose (1) storing a password in the table or (2) wherein 
said rule is that whether a total number of continuously receiving packets meeting said 
monitoring parameter in said interval is over said predetermined number. However both features 
were well known in the art at the time of Applicant's invention as evidenced by Nickles and 
Bruins. See the rejection of claim 3. 
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Claims 9 and 20 

As to claims 9 and 20, Abraham discloses ceasing the monitoring the time (b) when said 
end-user logs-out his|her terminal [column 8 «lines 23-25»]. 
Claims 11 and 22 

As to claims 1 1 and 22, Abraham discloses the monitoring the time (b) further comprises 
the step of analyzing whether there is a certain rule in said interval and whether said interval 
exceeds said threshold parameter, after acquiring said threshold parameter in the acquiring said 
monitoring parameter (a2), and the making anunciation to said end-user (c) further comprises 
making annunciation to said end-user, if there is a certain rule in said interval and said interval 
exceeds said threshold parameter [column 11 «lines 53-64» | column 13 «lines 53-60»]. 

Claims 23 and 24 

As to claims 23 and 24, Abraham discloses the end-user is not performing an 
administrative function of said application server [column 5 «line 63» to column 6 «line 4» : 
difference between client computers and administrative computers | column 16 «lines 12-16»]. 

Claim 25 

Abraham discloses the packet monitor is located in the channel between the application 
server and the end-user [Figure 2 «item 50»]. 
Claim 26 

Abraham discloses said packet monitor device is configured to compare information 
about said packets to said monitoring parameter [column 45 «lines 1-3 1» : determining whether 
the intercepted packets match any of the user-defined rules. Matching packets imply that the 
information about said packets is compared to the rules]. 
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Claim 27 

Abraham discloses a counter, wherein said counter is configured such that, if said rule is 
satisfied, then said counter is incremented [column 14 «lines 32-40» | column 46 «lines 1 1-24» | 
column 48 «lines 41-54» where : Abraham's log reads on Applicant's claimed counter. Every 
time a rule matches a rule, the log is updated to indicate the match. In this way, the log provides 
a count of the packets that matched the monitoring rule]. 

Claim 28 

Abraham discloses a comparator, which compares said counter to said threshold 
parameter [column 49 «lines l-22» where : the count in the log table is compared with a quota 
threshold]. 

Claim 29 

Abraham discloses said threshold parameter comprises a duration after which a packet 
coincides with the monitoring parameter [column 40 «lines 20-34» : predetermined time interval] 
or a service fee. 

IV. Claim 30 is rejected under 35 U.S.C. §103(a) as being unpatentable over 

Abraham and Nickles, in view of Applicant's admitted prior art ["admitted 
art"]. 

While Abraham does disclose services such as email and the Internet [Figure 8L], 
Abraham does not expressly disclose that such services are provided for a fee. However, 
providing services such as email or internet access for a fee was a well known feature in the art 
at the time of Applicant's invention. For example, Applicant's admitted art discloses that service 
providers typically employ service fees for using email or the Internet. Therefore it would have 
been reasonable for one of ordinary skill in the art to have inferred that Abraham's services were 
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provided for a fee as taught by Applicant's admitted art. It would have been obvious for one of 
ordinary skill in the art because service fees are valuable way for service providers to make a 
profit. 

Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to DOHM CHANKONG whose telephone number is (571)272- 
3942. The examiner can normally be reached on Monday-Friday [8:30 AM to 4:30 PM]. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Thu Nguyen can be reached on (571)272-6967. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Dohm Chankong/ 

Primary Examiner, Art Unit 2452 



